Week 13, 2024 security incident report
Hacking and data breach incidents newly reported 2024.03.25 ~ 03.31
From March 25 to 31, 2024, the hacking of Daesung Academy and Sidae Injae, which leaked information on 110,000 exam takers, and the leak of personal data of about 95,000 Digital Daesung members occurred in South Korea, highlighting large-scale information damage in the education industry. Damage investigations following attempted hacking of the National Satellite Operation Center and the hacking of South Korean satellite operation facilities were also presented as major incidents. There were 46 new incidents in total in South Korea and abroad, with personal data leaks (26) and hacking/intrusion cases (17) making up the majority. Overseas, the major incidents were the breach of information on 40 million voters at the UK Electoral Commission and the theft of patient and staff information at NHS Scotland along with threats to leak it, and cascading damage from Valley Oaks Health to Pomona Valley Hospital Medical Center also emerged.
By type
- Data breach26
- Hacking & intrusion17
- Ransomware2
- Malware1
Key incidents in South Korea
Personal data of about 95,000 Digital Daesung members leaked
95KImpact: Personal data of about 95,000 members
Digital Daesung, operator of Daesung Mimac, suffered credential stuffing and bulletin-board cross-site scripting attacks that leaked the personal data of about 95,000 members. Inadequate detection and blocking of excessive login attempts, missed vulnerability checks and delayed breach notification were identified. Korea's Personal Information Protection Commission (PIPC) imposed penalties on Digital Daesung, including a fine of 613 million won.
Related reports: 6 · last report →Daesung Academy and Sidaeinjae hacks leak data of 110,000 exam takers
110KImpact: Personal data of 110,000 exam takers leaked
Hacking at Daesung Academy and Sidaeinjae leaked the personal data of 110,000 exam takers. On March 28, 2024, it was reported that fines totaling 893 million won had been imposed in connection with the incident.
Related reports: 2 →Investigation launched after hacking attempt on National Satellite Operation Center
A hacking attempt targeted the National Satellite Operation Center. An investigation has begun to determine the extent of the damage.
Read on 전자신문 ↗South Korean satellite operations facility hacked ahead of space agency launch
A key facility for South Korea's satellite operations was breached by hackers. The security problem came to light just before the launch of the country's space agency.
Read on Chosunbiz ↗T-ara's Areum and boyfriend suspected of falsely claiming hack
Allegations emerged that T-ara's Areum and her boyfriend borrowed large sums of money from followers and then falsely claimed to have been hacked. Whether any actual hacking occurred has not been confirmed.
Read on 위키트리 ↗
Supply-chain breaches
Valley Oaks Health patient data breach
A data breach occurred at Valley Oaks Health, and patients were notified. A settlement over the breach later received preliminary court approval. The scale of the breach and the specific method of intrusion have not been confirmed.
Related reports: 2 · last report →
Key incidents in other countries
Patient and staff data stolen from NHS Scotland, attackers threaten leak
Impact: Claimed theft of sensitive patient and staff information; 3TB according to the attackers
Claims emerged that sensitive patient and staff information had been stolen in a hack targeting NHS Scotland. INC Ransom claimed to have stolen 3TB of data and threatened to publish it. A hacking-related warning was later issued to all residents of Dumfries and Galloway.
Related reports: 5 · last report →Former Jacksonville Jaguars employee hacked stadium scoreboard
Impact: Hacking of the stadium's giant video board
A former employee fired by the Jacksonville Jaguars, a US professional football team, hacked the stadium's giant video board. The former employee, a registered sex offender, was later sentenced to 220 years in prison for child sex crimes.
Related reports: 5 · last report →UK Electoral Commission hack compromises data of 40 million voters
40MImpact: Data of 40 million UK voters
The UK Electoral Commission was hacked, compromising the data of 40 million voters. The UK government named China as the perpetrator, and the UK Information Commissioner's Office pointed to poor online security management as the cause. The Electoral Commission later acknowledged it had learned painful lessons from the incident.
Related reports: 4 · last report →Personal data of 2.7 million Pakistanis leaked from government records
2.7MImpact: Personal data of 2.7 million Pakistani citizens
An investigation confirmed that personal data of 2.7 million Pakistani citizens had leaked from government records over a period of five years. The leaked data was personal information stored in a national database.
Related reports: 4 →China link alleged in hack of UK voter data
Impact: Information on tens of millions of UK voters affected
A cyberattack on UK voter data revealed that information on tens of millions of people was affected. The UK alleged a link between the attack and China, and the US indicted individuals identified as Chinese hackers. China rejected the hacking allegations made by the US and UK.
Related reports: 4 · last report →